analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

vd.msg

Full analysis: https://app.any.run/tasks/59b3a34d-8d47-4875-afaa-3a9c88d6c30d
Verdict: Malicious activity
Analysis date: October 14, 2019, 13:59:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.ms-outlook
File info: CDFV2 Microsoft Outlook Message
MD5:

BFFC279F8DA0FFE0A6FD7016FFFCFEA6

SHA1:

4C791E7A6AE45845CBD588C45376A0136E4B6E1E

SHA256:

B4262A83F3AC28D6C0EE4E011884B8DDFECD32B7C80F95A78FC4BD2577D0960A

SSDEEP:

768:NTfhtuR7qp/GsK3v+ARtOsKPsKPsKwzZ8nsQhmWhFX0Gv4v0WsK2bNL:Htmqpe0nnYzZ8sam+X0GW0WubNL

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Unusual execution from Microsoft Office

      • OUTLOOK.EXE (PID: 2200)
  • SUSPICIOUS

    • Starts Internet Explorer

      • OUTLOOK.EXE (PID: 2200)
    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 2200)
    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 2200)
    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 1024)
  • INFO

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 2200)
    • Manual execution by user

      • chrome.exe (PID: 1024)
    • Reads the hosts file

      • chrome.exe (PID: 656)
      • chrome.exe (PID: 1024)
    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3780)
    • Changes internet zones settings

      • iexplore.exe (PID: 2248)
    • Application launched itself

      • chrome.exe (PID: 1024)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msg | Outlook Message (58.9)
.oft | Outlook Form Template (34.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
90
Monitored processes
52
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe iexplore.exe iexplore.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2200"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\vd.msg"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
2248"C:\Program Files\Internet Explorer\iexplore.exe" https://appriver3651003526-my.sharepoint.com/:o:/g/personal/groessler_roesslerandsons_com/Em2vv5c5NlpFlS6Ket2yGPcBoBUSWAdvfcI9hBbcae1Y7A?e=5%3aAEdsZi&at=9C:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3780"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2248 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
1024"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
944"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x61a1a9d0,0x61a1a9e0,0x61a1a9ecC:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
1556"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2860 --on-initialized-event-handle=312 --parent-handle=316 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
4020"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1004,2149696713737319741,8203718232336837494,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=16159152805947956936 --mojo-platform-channel-handle=1016 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
656"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1004,2149696713737319741,8203718232336837494,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=9070312852575521697 --mojo-platform-channel-handle=1616 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
3152"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1004,2149696713737319741,8203718232336837494,131072 --enable-features=PasswordImport --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=10417314433948301689 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2000 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
2068"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1004,2149696713737319741,8203718232336837494,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=11477480974754260543 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2464 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Total events
2 445
Read events
1 732
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
126
Text files
316
Unknown types
16

Dropped files

PID
Process
Filename
Type
2200OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVRA775.tmp.cvr
MD5:
SHA256:
2248iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico
MD5:
SHA256:
2248iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
MD5:
SHA256:
2248iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFDB2607815C857B6D.TMP
MD5:
SHA256:
2200OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:E6F79B0A4FBEE0B2907D72C0EBD2F2FE
SHA256:25996D0132821EB3EACF41BD1B8EABE78454E715FBCADF8CA8C518E71C223CD1
2200OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:F9DB37B14C641CF32BB9BD75C9333D0F
SHA256:7C5F953EBC60C581C51F8A991C475CD44C7A6C3BA2E97B8121E26E7FCC2A01ED
2248iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF749BEFC80BF26F77.TMP
MD5:
SHA256:
2248iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF85BEDD2BD73898B6.TMP
MD5:
SHA256:
2248iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{DEEA9E6E-EE8A-11E9-AB41-5254004A04AF}.dat
MD5:
SHA256:
2200OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B0D8C410.datimage
MD5:C9BECF310A10745DEDDE9A326CA7AF6E
SHA256:E9F66A09867831301072375ED8C3325C160022E2BD12ABC420FA0EF3B0A57E2B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
75
DNS requests
51
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
656
chrome.exe
GET
200
74.125.4.216:80
http://r2---sn-aigzrney.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOTRmQUFXVHlhaGJaUTdMLWtCSkNJUl9ZQQ/1.0.0.5_nmmhkkegccagdldgiimedpiccmgmieda.crx?cms_redirect=yes&mip=185.92.25.20&mm=28&mn=sn-aigzrney&ms=nvh&mt=1571061496&mv=m&mvi=1&pl=24&shardbypass=yes
US
crx
293 Kb
whitelisted
656
chrome.exe
GET
302
172.217.22.110:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOTRmQUFXVHlhaGJaUTdMLWtCSkNJUl9ZQQ/1.0.0.5_nmmhkkegccagdldgiimedpiccmgmieda.crx
US
html
508 b
whitelisted
656
chrome.exe
GET
302
172.217.22.110:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOWVmQUFXS041NV9ZVXlJVWwxbGc5TUM4dw/7519.422.0.3_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx
US
html
513 b
whitelisted
656
chrome.exe
GET
200
74.125.4.169:80
http://r4---sn-aigzrne7.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOWVmQUFXS041NV9ZVXlJVWwxbGc5TUM4dw/7519.422.0.3_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx?cms_redirect=yes&mip=185.92.25.20&mm=28&mn=sn-aigzrne7&ms=nvh&mt=1571061496&mv=m&mvi=3&pl=24&shardbypass=yes
US
crx
862 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
656
chrome.exe
172.217.16.142:443
ogs.google.com
Google Inc.
US
whitelisted
656
chrome.exe
172.217.22.46:443
apis.google.com
Google Inc.
US
whitelisted
2200
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
2248
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3780
iexplore.exe
13.107.136.9:443
appriver3651003526-my.sharepoint.com
Microsoft Corporation
US
whitelisted
656
chrome.exe
216.58.210.3:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
656
chrome.exe
172.217.23.138:443
fonts.googleapis.com
Google Inc.
US
whitelisted
656
chrome.exe
13.107.136.9:443
appriver3651003526-my.sharepoint.com
Microsoft Corporation
US
whitelisted
656
chrome.exe
216.58.207.36:443
www.google.com
Google Inc.
US
whitelisted
656
chrome.exe
216.58.206.13:443
accounts.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
appriver3651003526-my.sharepoint.com
  • 13.107.136.9
suspicious
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
clientservices.googleapis.com
  • 216.58.210.3
whitelisted
accounts.google.com
  • 216.58.206.13
shared
www.google.com.ua
  • 216.58.207.35
whitelisted
fonts.googleapis.com
  • 172.217.23.138
whitelisted
www.gstatic.com
  • 216.58.210.3
whitelisted
fonts.gstatic.com
  • 216.58.210.3
whitelisted
apis.google.com
  • 172.217.22.46
whitelisted

Threats

No threats detected
No debug info